Data Subject Access Requests in Thailand: New 2026 PDPA Rules

What Are Data Subject Access Requests in Thailand?

A data subject access request is the formal exercise of an individual’s right to see the personal data an organization holds about them. Section 30 of the PDPA grants every data subject the right to request access to, and a copy of, their personal data, together with information about how that data was obtained without their consent. In practice, employees, customers, job applicants, and former business contacts can all invoke this right against a Thai data controller.

Until recently, the statute set out the right but left the mechanics unclear. Controllers were unsure how to verify identity, how long they had to respond, and when they could lawfully refuse. The new PDPC notification closes that gap. Consequently, businesses can no longer treat these requests as informal correspondence. Instead, they must follow a structured, auditable process from the moment a request arrives.

The New PDPC Notification: What Changed in 2026

The PDPC ran a public consultation on the draft rules from 16 April to 15 May 2026, then finalized the notification and published it in the Government Gazette. The rules take effect 30 days after publication, giving organizations a short runway to adapt. The notification does not create a new right. Rather, it operationalizes the existing one by standardizing procedural requirements that were previously left to each controller’s discretion.

For foreign investors, this shift matters because it raises the compliance bar across the board. A refusal or a missed deadline is no longer a grey area. It is now measurable against a published standard, which makes non-compliance easier for regulators and complainants to establish. Businesses that have already pursued the Thailand PDPA certification framework will find these access rules a natural extension of the same governance discipline. The notification also aligns Thai practice more closely with the GDPR model that many multinational parent companies already follow, so global privacy programs will need local calibration rather than wholesale reinvention.

Scope: What Data a Requester Can Demand

The notification sets a clear floor for what controllers must disclose. When responding to data subject access requests in Thailand, a controller must, at minimum, provide the following.

• Personal data collected directly from the data subject.
• Personal data obtained from other sources.
• The source of any personal data obtained from other sources without the data subject’s consent.

In addition, controllers must make available the transparency information required under Section 23 of the PDPA and the processing details recorded under Section 39, such as the categories of personal data collected and the purposes of processing. Therefore, a well-maintained record of processing activities is not just a standalone obligation. It is the backbone of a compliant access response.

How Requests Must Be Submitted and Verified

The notification requires controllers to offer at least two intake channels: in person and by post. Electronic and other channels remain optional, although most modern businesses will want to add them for practicality. A request may come directly from the data subject or through an authorized representative. Either way, it must be signed and must include enough identifying information, a preferred response method, and the details of what the requester wants.

Identity verification sits at the heart of the process. A controller must obtain identity documents and, where a representative acts, proof of authority. Notably, the notification permits different verification methods for requests submitted electronically, provided those methods do not create undue obstacles to the exercise of the individual’s rights. This flexibility helps digital businesses, but it also demands careful design so that verification protects the data without becoming a barrier that a regulator could view as obstructive. Where requests arrive through digital platforms, the interplay with Thailand’s electronic transactions law shapes how a signed, verifiable request can be captured online.

Response Timelines Every Business Must Meet

The most consequential change concerns deadlines. The notification fixes clear timelines that replace the previous uncertainty, and every controller should map these into its internal service levels immediately.

Because the response clock resets to the date on which complete and correct information arrives, precise intake logging is essential. A controller that cannot prove when a request became complete will struggle to defend its timeline if a complaint reaches the PDPC.

When You Can Refuse a Request

The right of access is broad, but it is not absolute. A controller may refuse a request where compliance is prohibited by law or a court order, or where disclosure would adversely affect the rights of third parties. Those third-party interests expressly include fundamental rights, trade secrets, and intellectual property. However, refusal cannot be the default response. Where only part of the data is protected, the controller should apply redaction or other measures and disclose the remainder.

Crucially, any refusal must be communicated with reasons and recorded in the record of processing activities. A silent or unexplained refusal is itself a breach. For businesses that handle competitively sensitive information, this means legal review of borderline requests should happen before, not after, a refusal is issued.

Fees, Recordkeeping, and Practical Compliance

The notification also addresses cost and documentation. Electronic access or copies that require no recording media and involve no direct transmission cost must be provided free of charge. Controllers may charge reasonable, capped fees for physical copies or labor-intensive requests, but only at actual cost and within the schedule set out in the notification. In every case, the controller must tell the data subject about any fees before or at the time the right is exercised.

On recordkeeping, controllers must retain each access request and its supporting evidence for at least two years. This retention rule turns the DSAR process into an audit trail. Regulators can later test whether a business met its deadlines, applied refusals correctly, and charged fees lawfully. As a result, disciplined documentation is now a core compliance safeguard rather than an administrative afterthought. Regulated sectors should also read this notification alongside adjacent duties, such as the insurance cybersecurity rules that impose parallel data governance obligations.

What Foreign Businesses in Thailand Should Do Now

Foreign-owned companies often run global privacy programs that assume a GDPR-style access process. Thailand’s rules are broadly compatible, but they carry local specifics that a generic policy will miss. To prepare for data subject access requests in Thailand, businesses should take the following steps.

• Publish compliant intake channels. Confirm that in-person and postal channels exist, and design any electronic channel with proportionate identity verification.
• Map the deadlines into a tracker. Automate the 7-day, 10-day, and 30-day milestones, with alerts and a documented extension-notice template.
• Refresh your record of processing activities. A current Section 39 record makes responses faster and supports lawful, well-reasoned refusals.
• Train frontline and HR teams. Staff must recognize a request on arrival, because the clock starts whether or not anyone flags it internally.
• Pre-clear sensitive scenarios. Agree in advance how you will handle requests that touch trade secrets, third-party data, or ongoing disputes.

Above all, treat the new rules on data subject access requests in Thailand as a live compliance deadline, not a policy footnote. Organizations that act before the effective date will avoid the scramble that inevitably follows the first well-documented complaint to the PDPC.

Frequently Asked Questions

Businesses handling customer data for campaigns should also review the rules on direct marketing in Thailand under the PDPA.